What happened
The OWASP AI Exchange (owaspai.org) announced a major content update now being finalised and published to the platform: it is adding the underlying research produced over the past year by its ~130 contributing authors that was accepted into ISO/IEC 27090 and the upcoming AI Act standard prEN 18282 (both on AI security). Because the copyrighted standard text cannot be shared publicly, the Exchange is publishing the underlying research to its online content, expanding it beyond 300+ pages. Separately, the project noted it has added 411 paragraphs of further agentic AI details to the framework content without changing the framework structure. The AI Exchange positions itself as the closest publicly available alignment of global expert consensus and feeds directly into the EU AI Act and ISO standards through a standards-development-organisation liaison partnership. The announcement was dated 19 October 2026 (in-window); the owaspai.org platform is live and describes the 300+ page constantly-evolving guidance, including threat/control categories for input attacks, development-time and supply chain threats, runtime conventional security threats, AI security testing, AI privacy, and general controls.
Why it matters
The OWASP AI Exchange is the de-facto open-source consensus reference for AI security controls, and this update synchronises it with the newly published ISO/IEC 27090 (published 14 October 2026) and the forthcoming European AI cybersecurity standard prEN 18282. The 411 paragraphs of added agentic AI detail extend the framework to cover autonomous agents, MCP and tool-using systems, which are the fastest-emerging attack surface. For practitioners, this makes owaspai.org the most accurate public view of the international consensus on how to protect AI systems, and it can be used for threat modelling and control selection ahead of formal standards availability. It is also a signal of where the ISO/IEC and EU standard content is heading, and reinforces the agentic-AI security emphasis across the standards landscape this week.
Action needed
Security and AI-risk teams should review the updated AI Exchange content on owaspai.org for threat-model and control guidance, especially the new agentic AI paragraphs, and use it to map controls and prepare for ISO/IEC 27090 and the forthcoming prEN 18282 (EU AI Act cybersecurity requirements).